Developer Publishes npm Packages Without Stored Tokens Using OIDC and Sigstore

·1 views

A developer shipped version 0.3.0 of SolAudit, a Solana static analyzer, with no npm token stored in CI secrets or on their machine. The method relies on npm's trusted publishing, which uses OpenID Connect so the GitHub Actions runner proves its identity and receives a short-lived, publish-scoped credential. Sigstore provenance attestations then let anyone verify that a package's tarball was built from a specific commit and workflow run. The author says the setup took about 30 minutes and describes this as a response to supply-chain risks posed by long-lived publish tokens. The walkthrough also covers configuring the trusted publisher on npmjs.com and two common pitfalls, including exact workflow filename matching.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Go Realtime Channels Should Notify, Not Store, Logistics Device State

A realtime channel should deliver current logistics device events to authorized dashboard clients, but it should not serve as the record of those events. Durable device state belongs in a database or log, with a small notification published afterward so clients know what changed. On reconnect, clients should read from the durable source before resuming the live stream, since a reconnected socket does not prove missed updates were received. Connection tokens should be scoped to tenant, facility, and topic, because browser clients are untrusted even when their users are. The author also recommends separate service targets for durable ingestion and dashboard freshness, and testing the gap between them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Deribit Gas Audit Finds About $2.5M in Potential Annual Savings

An independent audit examined Deribit's latest Ethereum mainnet deployment and its Optimism L2 contracts to assess gas efficiency. The review found several inefficiencies, including redundant storage operations, inefficient calldata encoding, and loop-based batch processing without early exits. Estimated combined savings across L1 and L2 reach roughly $2.5 million per year at current gas prices. The auditors reported no critical security flaws tied directly to gas usage, though some patterns could be abused to raise user transaction costs. Addressing these issues would also improve performance during periods of high network load.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Checkout failure alerting via polled logs and error APIs, with rollback kept separate

The article describes a checkout failure alerting design that polls logs and an errors API and evaluates the evidence in a shadow decision process before any action. Each checkout carries an operation ID through payment and reservation commit, and a poller normalizes records, saves source cursors, and checks a rolling window. Qualifying decisions produce durable alerts with idempotency keys, while an operator or separate controller verifies current reservation and payment state before any rollback. The author stresses that detection and control must stay separate, and that exception counts should never trigger rollback directly. The evidence contract is kept minimal, excluding guest names, addresses, payment data, and access tokens, and the decision threshold is passed in as a policy argument.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Generating Natural-Sounding Voice Content for E-Learning With Modern TTS

Engaging narration can improve learners' comprehension, retention, and satisfaction, which is pushing e-learning platforms away from static recordings toward AI-generated speech. Modern text-to-speech systems built on deep learning models produce expressive output, and they come in two forms: standard TTS using pre-trained voices, and voice cloning that replicates a specific speaker from a short audio sample. Both are available through REST APIs that can be integrated into course production workflows. The article walks developers through using ElevenLabs' API, covering account setup, secure storage of the API key, and a Python script that converts a lesson title and description into an MP3 file. A Node.js example is also provided for platforms built on that stack.

0 comments Read more at DEV Community